16 - Advanced Copilot Customization

# Developer Profile
I am a senior full-stack developer with 8 years of experience.
Main stack: Java (Spring Boot), TypeScript (Angular), PostgreSQL.
I work on microservice architectures in a cloud environment (AWS).

# Language Preferences
Always respond in English.
Use technical terminology appropriately
(e.g., "dependency injection", "middleware", "endpoint").

# Response Style
- Be concise and get straight to the point
- Always provide code examples when possible
- Include comments in code only for complex logic
- Specify versions when suggesting dependencies
- Flag potential performance or security issues

# Code Conventions
- Java: Google Java Style Guide
- TypeScript: ESLint with strict configuration
- SQL: uppercase for keywords, lowercase for table names
- Naming: camelCase for variables, PascalCase for classes
- Tests: Given-When-Then pattern for test names

# Anti-Patterns to Avoid
- Never suggest code without error handling
- Don't use "any" in TypeScript
- Don't suggest SQL queries with SELECT *
- Don't ignore input validation

# Copilot Instructions for TaskFlow Frontend

## Technology Stack
- Framework: Angular 21 with standalone components
- Language: TypeScript 5.9 strict mode
- Styling: SCSS with BEM methodology
- State Management: Angular Signals
- HTTP: Angular HttpClient with interceptors
- Routing: Angular Router with lazy loading
- Testing: Jasmine + Karma for unit, Cypress for E2E

## Code Conventions

### Components
- ALWAYS use standalone components (no NgModules)
- Change detection: OnPush for all components
- Use signals() for reactive state, not BehaviorSubject
- Template: separate file (.html) for components > 20 lines
- Styles: separate file (.scss) always

### Naming Conventions
- Components: PascalCase with Component suffix (e.g., UserProfileComponent)
- Services: PascalCase with Service suffix (e.g., AuthService)
- Interfaces: PascalCase with I prefix (e.g., IUserProfile)
- Files: kebab-case (e.g., user-profile.component.ts)
- Constants: UPPER_SNAKE_CASE (e.g., MAX_RETRY_COUNT)

### Mandatory Patterns
- Every HTTP service must have centralized error handling
- Use async pipe or toSignal() in templates, never manual subscribe
- Route guards as functional guards (not class-based)
- Forms: reactive forms with FormBuilder, never template-driven
- Validation: custom validators in separate file

### Directory Structure
```
src/app/
  features/       # Feature modules (lazy loaded)
  shared/         # Shared components, pipes, directives
  core/           # Singleton services, interceptors, guards
  models/         # Interfaces and types
  environments/   # Environment configurations
```

### Testing
- Every component MUST have unit tests
- Minimum coverage: 80% for services, 70% for components
- Mock pattern: use jasmine.createSpyObj for dependencies
- Test naming: "should [expected behavior] when [condition]"

### Performance
- Lazy load all feature routes
- Use trackBy for *ngFor (or @for with track)
- Images: use NgOptimizedImage
- Bundle size alert: > 500KB per chunk is a warning

### Accessibility
- Every interactive element must have aria-label
- Color contrast: WCAG AA (4.5:1 minimum)
- Tab navigation must work for all forms
- Screen reader: test with NVDA or VoiceOver

---
applyTo: "**/*.spec.ts"
---

# Instructions for Test Files

## Test Structure
- Use describe() to group tests by method/functionality
- Use beforeEach() for common setup
- AAA Pattern: Arrange, Act, Assert in every test

## Naming Convention
- describe: name of the class/function under test
- it/test: "should [what it does] when [condition]"

## Mock Pattern
```typescript
const mockService = jasmine.createSpyObj('ServiceName', ['method1', 'method2']);
mockService.method1.and.returnValue(of(expectedResult));
```

## Coverage Requirements
- Branch coverage: >= 80%
- Line coverage: >= 85%
- Every conditional path must have at least one test

## Anti-Patterns to Avoid
- Don't test implementation details
- Don't mock everything (test integration where possible)
- Don't use setTimeout() in tests (use fakeAsync/tick)
- Don't ignore flaky tests: fix them or remove them

---
applyTo: "src/app/core/services/**/*.ts"
---

# Instructions for API Services

## Mandatory Pattern
Every API service must follow this pattern:

```typescript
@Injectable({ providedIn: 'root' })
export class EntityService {
  private readonly apiUrl = `${environment.apiUrl}/entities`;

  constructor(private http: HttpClient) {}

  getAll(): Observable<Entity[]> {
    return this.http.get<Entity[]>(this.apiUrl).pipe(
      catchError(this.handleError)
    );
  }

  private handleError(error: HttpErrorResponse): Observable<never> {
    // Centralized in the interceptor, here only specific logging
    console.error(`EntityService error: ${error.message}`);
    return throwError(() => error);
  }
}
```

## Rules
- All HTTP methods must return Observable<T>
- Error handling via global interceptor + local logging
- Base URL from environment, never hardcoded
- Standard CRUD methods: getAll, getById, create, update, delete
- Use HttpParams for query parameters
- Cache with shareReplay(1) where appropriate

---
applyTo: "src/app/features/**/*.component.ts"
---

# Instructions for Feature Components

## Standard Component Template
```typescript
@Component({
  standalone: true,
  selector: 'app-feature-name',
  templateUrl: './feature-name.component.html',
  styleUrls: ['./feature-name.component.scss'],
  changeDetection: ChangeDetectionStrategy.OnPush,
  imports: [CommonModule, ReactiveFormsModule]
})
export class FeatureNameComponent {
  // Signals for local state
  readonly items = signal<Item[]>([]);
  readonly loading = signal(false);
  readonly error = signal<string | null>(null);

  // Computed for derivations
  readonly itemCount = computed(() => this.items().length);

  // Inject dependencies
  private readonly service = inject(FeatureService);
  private readonly destroyRef = inject(DestroyRef);
}
```

## Rules
- OnPush change detection MANDATORY
- Signals for all local state
- inject() function, not constructor injection
- DestroyRef for subscription cleanup
- Template max 50 lines, otherwise split into sub-components

# Copilot Instructions for TaskFlow Backend

## Stack
- Java 21 with Spring Boot 3.3
- Build: Gradle Kotlin DSL
- Database: PostgreSQL 16 with Flyway migrations
- Cache: Redis 7
- Auth: Spring Security + JWT
- API: REST with OpenAPI 3.1 documentation
- Testing: JUnit 5 + Mockito + Testcontainers

## Architecture
Hexagonal Architecture (Ports and Adapters):
```
src/main/java/com/taskflow/
  domain/          # Entities, value objects, domain exceptions
  application/     # Use cases, DTOs, port interfaces
  infrastructure/  # Adapters: DB, HTTP, messaging
  config/          # Spring configuration
```

## Java Conventions
- Records for immutable DTOs
- Sealed interfaces for controlled type hierarchies
- Optional only as return type, never as parameter
- Stream API for collection operations
- Naming: verb + noun for methods (e.g., createOrder, findUserById)

## API Design
- Endpoint: /api/v1/{resource} (plural)
- Response: wrapper with data, metadata, errors
- Pagination: page, size, sort query params
- Error format: RFC 7807 Problem Details
- Versioning: URL-based (/api/v1/, /api/v2/)

## Database
- Migrations: Flyway with naming V{version}__{description}.sql
- Table naming: snake_case, plural (e.g., user_profiles)
- Every table: id (UUID), created_at, updated_at
- Indexes: on all foreign keys and frequently searched fields
- NO cascade delete: handle explicitly

## Security
- Input validation on ALL endpoints
- SQL injection: only PreparedStatement/JPA
- Rate limiting: 100 req/min per user
- CORS: explicit whitelist
- Secrets: never in code, always from environment

# Acme Corp - GitHub Copilot Instructions

## Language
Always respond in Italian for the Italian team,
in English for everyone else.

## Security Standards
- Never suggest code that exposes secrets or credentials
- Always include input validation in endpoints
- Use prepared statements for all database queries
- Implement rate limiting on every public API
- Sensitive logs: never log PII, tokens, or passwords

## Company Code Conventions
- All services must have interface + implementation
- Naming: "Acme" prefix for base package (com.acme.*)
- JavaDoc documentation mandatory for public methods
- Commit message: Conventional Commits format
- Branch naming: feature/, bugfix/, hotfix/ + JIRA ticket

## Compliance
- Code must be GDPR compliant
- User data: always encrypted at rest
- Log retention: max 90 days
- Audit trail mandatory for CRUD operations on sensitive data

## Approved Libraries
- HTTP Client: OkHttp or Spring WebClient (no Apache HC legacy)
- JSON: Jackson (no Gson)
- Logging: SLF4J + Logback
- Testing: JUnit 5 + AssertJ + Mockito

{
  "servers": {
    "github": {
      "type": "remote",
      "url": "https://api.githubcopilot.com/mcp/github",
      "description": "GitHub API access for issues, PRs, repos"
    },
    "postgres-local": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-postgres",
        "postgresql://localhost:5432/taskflow"
      ],
      "description": "Local PostgreSQL database access"
    },
    "filesystem": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "--root",
        "${workspaceFolder}"
      ],
      "description": "File system access for project files"
    },
    "documentation": {
      "type": "remote",
      "url": "https://docs-mcp.example.com/v1",
      "headers": {
        "Authorization": "Bearer ${env:DOCS_API_KEY}"
      },
      "description": "Internal documentation search"
    },
    "sentry": {
      "type": "remote",
      "url": "https://mcp.sentry.io/sse",
      "headers": {
        "Authorization": "Bearer ${env:SENTRY_AUTH_TOKEN}"
      },
      "description": "Sentry error tracking integration"
    }
  }
}

# Format: one pattern per line
# Supports glob patterns

# Exclude sensitive configuration files
*.env
*.env.*
config/secrets/**

# Exclude non-modifiable legacy code
legacy/**
vendor/**

# Exclude automatically generated files
generated/**
dist/**
node_modules/**

# Exclude files with sensitive data
**/credentials*
**/private-keys/**
**/*.pem
**/*.key

# Exclude specific directories
src/app/proprietary/**
src/internal/billing/**

# Exclude test files with sensitive data
test/fixtures/sensitive-data/**

my-project/
  .github/
    copilot-instructions.md            # General project instructions
    instructions/
      testing.instructions.md          # Rules for test files
      api-controllers.instructions.md  # Rules for API controllers
      database.instructions.md         # Rules for queries and migrations
      components.instructions.md       # Rules for UI components
  .vscode/
    mcp.json                           # Project MCP servers
    settings.json                      # VS Code settings

# At the organization level (GitHub UI):
# - Organization Instructions (4000 char max)
# - Content Exclusion patterns
# - MCP server policy

# At the personal level (GitHub Settings):
# - Personal Instructions
# - Language and style preferences